CVE-2026-89030

Medium

Description

Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2s_search_user AJAX handler in includes/Ajax/Get.php invokes B2S_Tools::searchUser() in includes/Tools.php, which returns the email address of every matching user without restricting access to callers holding the list_users capability, allowing any user with the edit_posts capability to retrieve user email addresses including those of administrators.

SeverityMedium

CVSS4.3

Exploit probability—

ProductBlog2Social

PublishedSep 16, 2026

First seenSep 16, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

Adenion Blog2Social9.1.0 or later

Patches

wordpress.org/plugins/blog2social/#developers

Affected products

Product	Affected versions	Fixed in
Adenion Blog2Social	v < 9.1.0	9.1.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.